Privacy policy
Last updated: 29 October 2026
This privacy policy explains how we handle personal data when you visit the Vela Breeze Hotel Resort website. We have written it in plain language so you can see what happens with your data, why, and what choices you have.
What you should know up front:
- This website has no contact forms, accounts, chat or online booking. We only learn who you are if you write to us.
- We use no analytics or advertising cookies. The only cookie we set remembers your cookie choice.
- The website is hosted by Amazon Web Services in Frankfurt, Germany, in the European Union.
1. Who is responsible for your data
The data controller responsible for your personal data is:
- Prime Invest Limited
- Bwejuu, Zanzibar, Tanzania
- Registration number: Z0000196239
- VAT ID: 07102923V
- Email: info@vela-zanzibar.com
As the data controller, Prime Invest Limited decides how and why your personal data is processed.
2. EU representative
Prime Invest Limited is established outside the European Union but offers its services to people in the EU, so it designates a representative in the EU under Article 27 of the General Data Protection Regulation (GDPR): HyperSense Software SRL, Bucharest, Romania.
HyperSense Software SRL is in the process of being formally designated. Once that is complete, it will be a point of contact in the EU for data protection authorities and for anyone who wants to exercise their rights. In the meantime, please write to us directly at info@vela-zanzibar.com.
3. How to contact us about privacy
We have not appointed a Data Protection Officer. Send any question, concern or request about your personal data to:
- Email: info@vela-zanzibar.com
- Post: Prime Invest Limited, Bwejuu, Zanzibar, Tanzania
We aim to answer every privacy request within 30 calendar days.
4. What data we collect
| Data | When we collect it | What it contains |
|---|---|---|
| Server and delivery logs | Every time you load a page or file | Your IP address, the date and time, the page or file requested, the response status, your browser and device type (user agent) and the page that linked to us |
| Your cookie choice | When you answer the cookie banner | The categories you accepted or rejected, when, and a random consent identifier. See our cookie policy. |
| Visit measurement (Google Analytics) | Every time you load a page | The page viewed and how you reached it, your browser and device type, and your approximate location derived from your IP address. Only if you accept analytics cookies, also a random identifier stored in a cookie, which links your visits |
| Emails you send us | When you write to us | Your email address, your name and anything you include in your message |
We do not collect data through forms or accounts on this website, and we do not buy data about you from anyone else.
5. Why we use your data and our legal basis
Under the GDPR we need a legal basis for each use of your personal data. The table lists every purpose, the data involved and the basis we rely on.
| Purpose | Data used | Legal basis |
|---|---|---|
| Showing you the website and keeping it secure and working | Server and delivery logs | Legitimate interest (Article 6(1)(f)): running a secure, reliable website. |
| Recording and respecting your cookie choice | Your cookie choice | Legal obligation (Article 6(1)(c)): the cookie rules require us to ask for consent and to be able to show that we did. |
| Answering your emails, for example about the hotel or its opening | Emails you send us | Legitimate interest (Article 6(1)(f)): replying to the people who write to us. When you ask about a future stay, steps taken at your request before a contract (Article 6(1)(b)). |
| Measuring how the website is used | Visit measurement (Google Analytics) | Consent (Article 6(1)(a)) for measurement with analytics cookies. Without that consent, Google Analytics receives measurements without cookies, for which we rely on our legitimate interest in counting visits to the website (Article 6(1)(f)). |
| Complying with the law and defending legal claims | Any of the above, only where needed | Legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)). |
Where we rely on legitimate interest, we have checked that the processing is necessary and does not override your rights and freedoms. You can object to it at any time (section 10).
6. Who we share your data with
We do not sell your personal data. These service providers process it on our behalf and only on our instructions:
| Recipient | Location | Data | Purpose |
|---|---|---|---|
| Amazon Web Services (AWS) | EU (Frankfurt, Germany); the CloudFront delivery network serves pages from the location nearest to you | Server and delivery logs, and the record of your cookie choice | Hosting and delivering the website, and keeping the record of consent |
| Google (Google Workspace) | EU and United States | Emails you send us | Our email service |
| Google (Google Analytics) | EU and United States | Visit measurement | Measuring how the website is used |
Inside Prime Invest Limited, only the people who handle hotel enquiries read the emails you send us. We may also disclose personal data when the law, a court or a regulator requires it, or to protect our legal rights.
7. International transfers
The website and its logs are stored in the EU. Some data leaves the European Economic Area, and each transfer is protected as follows:
- CloudFront may deliver a page from a location outside the EEA when that is nearest to you. AWS protects these transfers with the European Commission's Standard Contractual Clauses.
- Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognised as adequate on 10 July 2023, and Google Workspace also includes Standard Contractual Clauses.
- Prime Invest Limited is based in Tanzania, so the team that answers your emails reads them there. We protect that data with access controls and use it only as this policy describes.
You can ask for a copy of these safeguards at info@vela-zanzibar.com.
8. How long we keep your data
| Data | How long | Why |
|---|---|---|
| Server and delivery logs | Up to 12 months | Security monitoring and fixing faults |
| Your cookie choice (the cookie on your device) | 6 months, after which we ask again | Not asking you on every visit |
| Records of your cookie choice | As long as we need to show that we asked for your consent | Proving consent |
| Emails you send us | Up to 2 years after our last exchange, longer only if a booking or a legal matter requires it | Following up on your enquiry |
| Visit measurement in Google Analytics | Up to 14 months | Understanding how the website is used |
When a period ends, we delete the data or make it anonymous.
10. Your rights
Under the GDPR you have the following rights over your personal data:
- Access (Article 15): ask for a copy of the data we hold about you and how we use it.
- Rectification (Article 16): ask us to correct inaccurate or incomplete data.
- Erasure (Article 17): ask us to delete your data, unless the law requires us to keep it.
- Restriction (Article 18): ask us to pause using your data while a question about it is settled.
- Portability (Article 20): receive the data you gave us in a structured, machine-readable format.
- Objection (Article 21): object to any use based on legitimate interest. We then stop unless we have compelling grounds that override yours.
- Withdrawing consent (Article 7(3)): change your cookie choice at any time, which does not affect what happened before.
To exercise a right, write to info@vela-zanzibar.com and tell us which right and which data. We answer within 30 calendar days. For a complex request we may extend that by up to 60 days, and we will tell you within the first 30. It is free, unless a request is manifestly unfounded or excessive.
If you are unhappy with how we handle your data, you can complain to a data protection authority: the one in the EU country where you live, or the Romanian authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania.
ANSPDCP website: dataprotection.ro
11. Whether you have to give us data
No. You can read this whole website without giving us anything beyond what every browser sends with a request, which ends up in our logs. Writing to us is up to you; without your email address we cannot reply.
12. Children
This website is not aimed at children under 16, and we do not knowingly collect their data. If you believe a child has sent us personal data, write to info@vela-zanzibar.com and we will delete it.
13. Changes to this policy
We will update this policy when our website or the law changes, for example when bookings open. The date at the top shows the latest version. We will announce significant changes, such as a new kind of processing or a new recipient, on the website before they take effect.